82 lines
2.2 KiB
Markdown
82 lines
2.2 KiB
Markdown
# LLDAP Block {#blocks-lldap}
|
|
|
|
Defined in [`/modules/blocks/lldap.nix`](@REPO@/modules/blocks/lldap.nix).
|
|
|
|
This block sets up an [LLDAP][] service for user and group management
|
|
across services.
|
|
|
|
[LLDAP]: https://github.com/lldap/lldap
|
|
|
|
## Global Setup {#blocks-lldap-global-setup}
|
|
|
|
```nix
|
|
shb.lldap = {
|
|
enable = true;
|
|
subdomain = "ldap";
|
|
domain = "example.com";
|
|
dcdomain = "dc=example,dc=com";
|
|
|
|
ldapPort = 3890;
|
|
webUIListenPort = 17170;
|
|
|
|
jwtSecret.result = config.shb.sops.secret."lldap/jwt_secret".result;
|
|
ldapUserPassword.result = config.shb.sops.secret."lldap/user_password".result;
|
|
};
|
|
shb.sops.secret."lldap/jwt_secret".request = config.shb.ldap.jwtSecret.request;
|
|
shb.sops.secret."lldap/user_password".request = config.shb.ldap.ldapUserPassword.request;
|
|
```
|
|
|
|
This assumes secrets are setup with SOPS
|
|
as mentioned in [the secrets setup section](usage.html#usage-secrets) of the manual.
|
|
|
|
## SSL {#blocks-lldap-ssl}
|
|
|
|
Using SSL is an important security practice, like always.
|
|
Using the [SSL block][], the configuration to add to the one above is:
|
|
|
|
[SSL block]: blocks-ssl.html
|
|
|
|
```nix
|
|
shb.certs.certs.letsencrypt.${domain}.extraDomains = [
|
|
"${config.shb.lldap.subdomain}.${config.shb.lldap.domain}"
|
|
];
|
|
|
|
shb.ldap.ssl = config.shb.certs.certs.letsencrypt.${config.shb.lldap.domain};
|
|
```
|
|
|
|
## Restrict Access By IP {#blocks-lldap-restrict-access-by-ip}
|
|
|
|
For added security, you can restrict access to the LLDAP UI
|
|
by adding the following line:
|
|
|
|
```nix
|
|
shb.lldap.restrictAccessIPRange = "192.168.50.0/24";
|
|
```
|
|
|
|
## Manage User and Group {#blocks-lldap-manage-user-group}
|
|
|
|
Currently, managing users and groups must be done manually.
|
|
Work is in progress to make this declarative.
|
|
|
|
## Troubleshooting {#blocks-lldap-troubleshooting}
|
|
|
|
To increase logging verbosity, add:
|
|
|
|
```nix
|
|
shb.lldap.debug = true;
|
|
```
|
|
|
|
Note that verbosity is truly verbose here
|
|
so you will want to revert this at some point.
|
|
|
|
## Tests {#blocks-lldap-tests}
|
|
|
|
Specific integration tests are defined in [`/test/blocks/lldap.nix`](@REPO@/test/blocks/lldap.nix).
|
|
|
|
## Options Reference {#blocks-lldap-options}
|
|
|
|
```{=include=} options
|
|
id-prefix: blocks-lldap-options-
|
|
list-id: selfhostblocks-block-lldap-options
|
|
source: @OPTIONS_JSON@
|
|
```
|